Complete characterization of perfectly secure stego-systems with - - PowerPoint PPT Presentation

Complete characterization of perfectly secure stego-systems with mutually independent embedding operation

Tomáš Filler and Jessica Fridrich

• Dept. of Electrical and Computer Engineering

SUNY Binghamton, New York

IEEE ICASSP 2009, Taipei, Taiwan

Steganography

Steganography is a mode of covert communication.

Emb(·) message m key k cover X Ext(·) key k message m channel with passive warden stego Y

X and Y are r.v. on X n not necessarily i.i.d. Emb(·), Ext(·) ... embedding, extraction functions Perfectly secure stegosystem (Cachin): Cover distribution P and stego distrib. Q satisfy DKL(P||Q) = 0

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 2 of 14

Mutually Independent Embedding Operation

Emb(·) is a probabilistic mapping acting on each cover element (pixel, DCT, ...) independently - MI embedding. Pr(Yl = j|Xl = i) = bij(β)

Xl ... l-th cover element Yl ... l-th stego element β ... change rate (rel. payload)

Matrix B = (bij) is stochastic (rows are pmfs) for all β ≥ 0. LSB embedding:

= 1 −β = β = 1

B =

1 3 5 2 4 6

F5: B =

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 3 of 14

Perfectly Secure Cover Source

Cover source is perfectly secure w.r.t. given MI embedding ⇔ the resulting stegosystem is perfectly secure.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 4 of 14

Our Contribution

P ... cover distr. Qβ ... stego distr. with change rate β Given specific MI embedding (matrix B):

1 Complete characterization of perfecly secure cover

sources w.r.t. B.

2 Cover source is perfectly secure iff

I(0) = ∂ 2DKL(P||Qβ) ∂β 2

• β=0 = 0.

In general DKL(P||Qβ) = 0 I(0) = 0

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 5 of 14

(1) Complete characterization of perfectly secure cover distributions

Perfectly Secure Covers w.r.t. MI embedding

Invariant distributions of MI embedding: Matrix B is stochastic ⇒ has k ≥ 1 left eigenvectors (invariant distributions) π(a), a ∈ {1,...,k} to 1, π(a)B = π(a).

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 7 of 14

Perfectly Secure Covers w.r.t. MI embedding

Invariant distributions of MI embedding: Matrix B is stochastic ⇒ has k ≥ 1 left eigenvectors (invariant distributions) π(a), a ∈ {1,...,k} to 1, π(a)B = π(a). Example (perfectly secure cover): If P(X1 = i,X2 = j) = π(a)

i

π(a′)

i

, then P is perfectly secure.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 7 of 14

Perfectly Secure Covers w.r.t. MI embedding

Invariant distributions of MI embedding: Matrix B is stochastic ⇒ has k ≥ 1 left eigenvectors (invariant distributions) π(a), a ∈ {1,...,k} to 1, π(a)B = π(a). Example (perfectly secure cover): If P(X1 = i,X2 = j) = π(a)

i

π(a′)

i

, then P is perfectly secure. Elements distributed independently with some invariant distribution form perfectly secure cover source. Set of all perfectly secure distributions form convex hull. We know at least kn linearly independent perfectly secure cover sources on n elements.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 7 of 14

Perfectly Secure Covers w.r.t. MI embedding

Invariant distributions of MI embedding: Matrix B is stochastic ⇒ has k ≥ 1 left eigenvectors (invariant distributions) π(a), a ∈ {1,...,k} to 1, π(a)B = π(a). Example (perfectly secure cover): If P(X1 = i,X2 = j) = π(a)

i

π(a′)

i

, then P is perfectly secure. Elements distributed independently with some invariant distribution form perfectly secure cover source. Set of all perfectly secure distributions form convex hull. We know at least kn linearly independent perfectly secure cover sources on n elements. Do we know all of them?

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 7 of 14

Perfectly Secure Covers - Main Result

k ... number of invariant distributions of given MI embedding

Theorem (Mutually independent embedding)

There are exactly kn linearly independent perfectly secure probability distributions P on n-element covers. Every perfectly secure probability distribution P w.r.t. B can be obtained by a convex linear combination of kn linearly independent perfectly secure distributions.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 8 of 14

Perfectly Secure Covers - Main Result

k ... number of invariant distributions of given MI embedding

Theorem (Mutually independent embedding)

There are exactly kn linearly independent perfectly secure probability distributions P on n-element covers. Every perfectly secure probability distribution P w.r.t. B can be obtained by a convex linear combination of kn linearly independent perfectly secure distributions.

Corollary (MI embedding in stationary covers)

There are exactly k linearly independent perfectly secure probability distributions P on n-element covers. These sources are i.i.d. with some invariant distribution π(a).

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 8 of 14

Perfectly Secure Covers - Example

LSB embedding:

= 1 −β = β

B =

1 3 5 2 4 6

Left unit eigenvectors of B (invariant distributions):

π(1) = ( 1

2, 1 2,0,0,0,0),

π(2) = (0,0, 1

2, 1 2,0,0),

π(3) = (0,0,0,0, 1

2, 1 2)

k = 3 π(a)B = π(a) Perfectly secure cover w.r.t. LSB embedding must be independent with evened out histogram bins.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 9 of 14

(2) Fisher Information and perfectly secure cover distributions

Perfect Security and Fisher Information

P ... cover distr. Qβ ... stego distr. with change rate β Observation: If P is perfectly secure w.r.t. B, then I(0) = 0. DKL(P||Qβ) = DKL(Q0||Qβ) = 1

2I(0) ·β 2 +O(β 3)

Fisher Information (w.r.t. change rate β): I(0) = EP ∂ ∂β logQβ(Y )

• β = 0

2 = ∂ 2DKL(P||Qβ) ∂β 2

• β=0

I(0) is related to quantitative steganalysis (Cramer-Rao LB). What can we say about security of P w.r.t. B if I(0) = 0?

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 11 of 14

Perfect Security and Fisher Information

P ... cover distr. Qβ ... stego distr. with change rate β Observation: If P is perfectly secure w.r.t. B, then I(0) = 0. DKL(P||Qβ) = DKL(Q0||Qβ) = 1

2I(0) ·β 2 +O(β 3)

Fisher Information (w.r.t. change rate β): I(0) = EP ∂ ∂β logQβ(Y )

• β = 0

2 = ∂ 2DKL(P||Qβ) ∂β 2

• β=0

I(0) is related to quantitative steganalysis (Cramer-Rao LB). What can we say about security of P w.r.t. B if I(0) = 0? Nothing in general but a lot for MI embedding!

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 11 of 14

Fisher Information vs. Perfect Security

Theorem (Fisher Information)

There are exactly kn linearly independent probability distributions P on n-element covers satisfying I(0) = 0. These distributions are perfectly secure w.r.t. B. Every other probability distribution P satisfying I(0) = 0 can be obtained by convex linear combination of kn linearly independent perfectly secure distributions.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 12 of 14

Fisher Information vs. Perfect Security

Theorem (Fisher Information)

There are exactly kn linearly independent probability distributions P on n-element covers satisfying I(0) = 0. These distributions are perfectly secure w.r.t. B. Every other probability distribution P satisfying I(0) = 0 can be obtained by convex linear combination of kn linearly independent perfectly secure distributions.

Corollary (equivalent condition for perfect security)

For arbitrary MI embedding and under no assumption about cover source I(0) = 0 ⇔ DKL(P||Qβ) = 0

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 12 of 14

Application in Determining Steganographic Capacity

Capacity of imperfect stegosystems with MI embedding only increases with the square root of the number of cover elements (pixels). Square Root Law of IMPERFECT steganography:

1 If nβn

√n → 0 then the stegosyst. are asymptotically secure.

2 If nβn

√n → +∞ then arbitrarily accurate stego detectors

exist. We used I(0) = 0 to exclude all perfectly secure covers.

[Filler, Ker, Fridrich, “The Square Root Law of Steganographic Capacity for Markov Covers”, Proc. SPIE, 2009]

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 13 of 14

Conclusion and Future Directions

Virtually all stegosystems use MI embedding in some appropriate domain (this makes our result relevant to most stegosystems).

Perfectly secure covers form convex hull with known basis. Fisher information w.r.t. change rate is an equivalent perfect security descriptor is valuable tool for theoretical steganalysis (SRL) Future work: use Fisher information for benchmarking stegosystems.

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 14 of 14

Conclusion and Future Directions

Virtually all stegosystems use MI embedding in some appropriate domain (this makes our result relevant to most stegosystems).

Perfectly secure covers form convex hull with known basis. Fisher information w.r.t. change rate is an equivalent perfect security descriptor is valuable tool for theoretical steganalysis (SRL) Future work: use Fisher information for benchmarking stegosystems.

Thank you!

tomas.filler@binghamton.edu

Filler, Fridrich Complete characterization of perfectly secure stego-systems... 14 of 14